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Abstract —Physical layer network coding (PNC) has been 
proposed for next generation networks. In this contribution, 
we investigate PNC schemes with embedded perfect secrecy by 
exploiting structured interference in relay networks with two 
users and a single relay. In a practical scenario where both users 
employ finite and uniform signal input distributions we propose 
upper bounds (UBs) on the achievable perfect secrecy rates 
and make these explicit when PAM modems are used. We then 
describe two simple, explicit encoders that can achieve perfect 
secrecy rates close to these UBs with respect to an untrustworthy 
relay in the single antenna and single relay setting. Lastly, we 
generalize our system to a MIMO relay channel where the relay 
has more antennas than the users and optimal precoding matrices 
which maintain a required secrecy constraint are studied. Our 
results establish that the design of PNC transmission schemes 
with enhanced throughput and guaranteed data confidentiality 
is feasible in next generation systems. 

Index Terms —Physical layer network coding, achievable se¬ 
crecy rate, perfect secrecy, signal space alignment 

I. Introduction 

Recently, the ideas of network coding [ilj have been ex¬ 
tended to the wireless physical medium; notably, in El, 
0, among others, the concept of harnessing interference 
through structured codes was explored in the framework of 
physical layer network coding (PNC). These technologies can 
be proven instrumental in enabling the envisaged multi-fold 
increase in data throughput in fifth generation (5G) networks 
0. The generic PNC system model with two independent 
sources and one relay is depicted in Fig. Q] and assumes that 
communication is executed in two cycles. In the first cycle, 
the nodes A, referred to as Alice, and B, referred to as Bob, 
transmit simultaneously respective codewords to the relay node 
R, referred to as Ray. In the second cycle, Ray, broadcasts to 
Alice and Bob a function of the total received signal; Alice and 
Bob then retrieve each’s other messages by canceling off their 
corresponding transmissions. Depending on the transformation 
executed by Ray, one of the following relaying strategies 
can be employed: amplify and forward, decode and forward, 
compress and forward 0, or the recently introduced compute 
and forward 0 approach. 

Nevertheless, despite the potential for substantial increase of 
the transmission rates in wireless networks, a major obstacle in 
the widespread deployment of PNC and generally of relay net¬ 
works arises due to security concerns, i.e., the confidentiality 
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First transmission cycle 
Second transmission cycle 

Fig. 1. Physical layer network coding (PNC) with two transmitter and one 
relay node. 

of the exchanged data with respect to an untrustworthy relay. 
A straightforward approach would be employing encryption 
at upper layers of the communication network or encryption 
at the physical layer 0 . However, the management of secret 
keys used by the crypto algorithms depends on the structure 
of the access network and already fourth generation systems 
(4G) have a key hierarchy of height five (5) for each individual 
end-user, while there exist multiple keys in each layer of 
the hierarchy 0. Extrapolating from the experience of 4G 
systems, it is expected that the management of secret keys 
in 5G would become an even more complicated task 0. The 
generation, the management and the distribution of secret keys 
in decentralized settings, such as device-to-device PNC net¬ 
works, without an infrastructure that supports key management 
and authentication will impose new security challenges. 

An alternative theoretical framework for the study of data 
confidentiality in the physical layer of wireless networks, 
dubbed as physical layer security m-m, has recently be¬ 
come a focal point of research in the wireless community. The 
metric of interest, referred to as the channel secrecy capacity 
is the supremum of transmission rates at which data can be 
exchanged reliably while satisfying a weak secrecy 03, m, 
a strong secrecy 1131 or a perfect secrecy constraint fl6l . As 
an example, let X n be the n-length encoded version of a nR- 
bit message transmitted by the source and let Z n denote the 
passive eavesdropper’s information. Weak and strong secrecy 
assume that the code’s blocklength n becomes arbitrarily long, 
while Shannon’s definition of perfect secrecy in M on the 
other hand explicitly assumes a finite blocklength, i.e., 

lim —I{X n \Z n ) = 0, weak secrecy constraint, (1) 

n—too 77 , 

lim I(X n -,Z n ) = 0, strong secrecy constraint, (2) 

n—too 

I(X;Z)=0 , perfect secrecy constraint. (3) 

The first study of weak secrecy in relay channels with 
confidential messages has appeared in 03 while further 
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Fig. 2. Nested encoder for strong secrecy in PNC systems: Alice encodes the secret messages using an inner encoder 6 a for reliability and an outer encoder 
c pa for secrecy. On the other hand, Bob employs the corresponding decoders <f>B and fig to obtain an estimate of the secret messages transmitted by Alice. 


analyses followed DS1, DU; these contributions established 
that the secrecy capacity of one-way relay channels is zero, 
unless the source-destination channel is better than the source- 
relay channel. In essence, relay topologies of practical interest 
in which the link to the relay is better than the direct link 
were shown to be inherently insecure. Due to this limiting 
result, subsequent work focused entirely on cooperative relay 
channels with trustworthy relays, Ii20l - ll23l to cite but a few. 

However, unlike one-way relay networks, systems employ¬ 
ing network coding can on the other hand benefit from the 
simultaneity of transmissions to an untrustworthy relay to 
achieve data confidentiality as noted in ll24l . In essence, the 
structured interference observed by the relay can be exploited 
to achieve strong secrecy in the wireless transmissions |25l , 
[26]. In m-m the role of interference in achieving strong 
secrecy was demonstrated using lattice encoders; in these 
works the superposition of the interference to the data was 
viewed as a modulo addition operation, i.e., the superposition 
was assumed to take place in the code space and not in the 
signal space. 

In the present study, PNC networks in which Ray can 
observe superpositions in the signal space (real sums of signals 
transmitted by Alice and Bob as opposed to modulo sums in 
the code space) are investigated in the presence of synchro¬ 
nization errors assuming all nodes employ M- ary pulse ampli¬ 
tude modulation (M-PAM) transceivers; this realistic scenario 
is fundamentally more demanding than previously investigated 
settings l23l . To separate the problem of secrecy from error 
correction, we first restrict to a noiseless channel where we 
evaluate upper bounds (UBs) on the achievable perfect secrecy 
rates, make these explicit in the case of PAM modems, and 
investigate the effect of synchronization errors on secrecy. The 
proposed secret encoders in the single input single output 
(SISO) setting are constructive examples of coset coding 
that allow Ray to obtain estimates of linear combinations 
of the transmitted PAM symbols but not to retrieve any of 
the secret bits they carry, thus achieving perfect secrecy, 
i.e., zero information leakage per PAM symbol. Finally, our 
system model is extended to the multiple input multiple output 
(MIMO) case in which we study optimal precoding matrices 
which achieve the required signal alignment at the relay, 
while preserving secrecy. Our study differs from earlier work 
on interference alignment for secrecy Eo). ED. El and 
interference alignment for the MIMO channel |[33l in that the 


required secrecy conditions demand equality of matrices rather 
than just of the subspaces generated by their columns. 

The paper is organized as follows. In Section [II] the SISO 
system model is presented. In Section [III] we propose upper 
bounds (UBs) on the achievable perfect secrecy rates of 
the noiseless SISO system given finite constellations, pro¬ 
vide explicit formulas for these bounds in the case of PAM 
modems, and further discuss the impact of synchronization 
errors on the upper bounds. In Section[IV]two explicit encoders 
achieving perfect secrecy are constructed, the first assuming 
no cooperation between the users, and the second assuming 
that the user of the smaller constellation has some non-trivial 
information about the signal transmitted by the other user. 
Both approaches are shown to be close to the relevant upper 
bounds. In Section [V] we generalize our setup to a noisy 
MIMO channel in which the users and the relay have multiple 
antennas, and study optimal precoding matrices. Finally in 
Section [VT] the conclusions of this contribution are drawn and 
future directions of the work are discussed. 

II. Secure PNC System Model 

Communication between Alice and Bob with the help of 
Ray takes place into two cycles as depicted in Fig. □ In 
what follows, we use the subscript A to denote quantities 
and variables (source symbols, codewords, etc.) corresponding 
to Alice and the subscript B for those belonging to Bob. 
All channel coefficients and encoding/decoding algorithms are 
public, i.e., known by Alice, Bob, and Ray. The notation 
x n denotes the sequence [x(l), x(2 ),..., x(n)] while lower 
case letters denote realizations of respective random variables 
that are represented with the corresponding upper case letters, 
e.g., x denotes a realization of the random variable X with 
probability mass function (pmf) px{x). 

We assume that Alice’s and Bob’s source symbols (se¬ 
cret messages) are drawn from discrete alphabets. Under 
an average power constraint, the use of Gaussian encoders 
has been demonstrated to achieve the secrecy capacity of 
the interference channel [34|. However when transmission is 
constrained by a joint amplitude-variance constraint] it has 
been shown that the capacity is on the contrary achieved by 
employing codebooks of finite size; a recent extension of these 

'Under this realistic assumption the amplitude of the transmitted signals is 
bounded, as in all actual communication systems. 
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results in the wiretap channel has shown that this holds true 
for the secrecy capacity as well (35). Due to this reason, in the 
following we exclusively operate under the assumption that all 
codebooks have finite size. 

We start by examining the scenario in which all nodes have 
single antennas while the multi-antenna case will be covered 
in a later section. In the present work we treat separately the 
design of secrecy encoders from error correction encoding; this 
can be straightforwardly achieved with the nested structure 
depicted in Fig. [2] including an inner encoder for reliability 
and an outer encoder for secrecy. The reason we propose this 
approach is that, contrary to error correction, in the noiseless 
PNC setting it is possible to achieve perfect secrecy without 
introducing any delay, i.e., secrecy is achieved on a per symbol 
basis and does not rely on the existence of noise to increase 
the equivocation at Ray but rather on structured interference. 

In the presentation of the proposed nested encoder we 
employ the following notation: Alice (respectively Bob) em¬ 
ploys a rate q, n £ IN, q < n inner encoder for reliability 
denoted by 9 A (respectively On) and corresponding decoder 
denoted by t)rs (respectively 0a)- Furthermore, to ensure 
perfect secrecy Alice (Bob) uses a unit symbol rate outer 
secrecy encoder denoted by p A (respectively ps) with a 
corresponding decoder (bn (respectively 0a)- On the other 
hand Ray employs a PNC wrapping function (e.g., “compress 
and forward”) denoted by /. In subsections III-AI to III-CI we 
explain the above setting in further detail and discuss the 
necessary secrecy conditions. 

A. First transmission cycle 

Inner encoder for reliability: In the first cycle Alice maps 
length-g sequences of secret messages sa £ S A , selected 
uniformly at random from the set 5 a of secret messages 
to length-n codewords. To this end, Alice first employs an 
encoder 9a '■ S\ -A U A , 9 a (s a ) = u n A . Similarly Bob maps 
length-g sequences of secret messages sb £ Sb using an 
encoder 9b : S q B -A U B , 9b(s b ) = Mg . 

Outer encoder for perfect secrecy: Alice and Bob encode 
the sequences u’a and u B respectively to codewords x A and 
x'jj element by element using corresponding encoders p A '■ 
Ua —> X A and ips ■ Ub —> Xb with p A (u A ) = x A and 
<Pb(ub) = Xb- We define Ma and Mb to be the sizes of the 
codebooks Xa and Xb, denoted by \Xa\ = Ma and \X B \ = 
M B - We set itia = log 2 Ma and ms = log 2 M B . 

Ray’s observation (assuming perfect synchronization at 
Alice and Bob) can be expressed as 

y = hAXA + hBXB + WR = xr + wr, ( 4 ) 

where h A (respectively hs) is the channel (fading) coefficient 
in the link from Alice (Bob) to Ray, xr = h A x A +hnxn, and 
wr is the noise at Ray, modeled as (a realization of) a zero- 
mean circularly symmetric Gaussian complex random variable 
with variance <j' 2 r . 

B. Second transmission cycle 

PNC wrapping: In the second cycle of the communication, 
Ray performs a wrapping of the received PNC observation y 


to compressed PNC observations using a mapping / : y —► 
Z, where f(y) = z (e.g., possible options for this mapping 
include “compress and forward” and “compute and forward”). 
We assume that / is invertible given either xa or x n , that 
is, that Alice can recover y from z given that she knows xa, 
and similarly for Bob. An obvious choice is to select Z = y 
and have / be the identity function, i.e., Ray forwards exactly 
what he receives. 

Finally, Ray transmits 0 to Alice and Bob, who then observe 

y A = h A z + w A , (5) 

y B = h B z + w B , (6) 

where h A (respectively h B ) is the channel (fading) coefficient 
from Ray to Alice (Ray to Bob), and wa (wn) is the noise 
at Alice (Bob), modeled as a circularly symmetric complex 
Gaussian random variable with variance a A (erg). 

Alice uses a decoder (j) A ■ Ya —> Ub, to produce esti¬ 
mates <p A (y A ) = ub of Bob’s transmitted secret codewords. 
Respectively, Bob uses a function 0n : Yn —> Ua, to 
produce estimates fsiUB) = ua of Alice’s transmitted secret 
codewords. 

For the purposes of error correction Alice (Bob) employs a 
decoding function Da ■ U B -A S q B with = s q B (Db ■ 

U\ -A S[\ with 1 9b (u'a) = s q A ). Focusing exclusively on the 
secrecy of the PNC scheme, we assume that lim n ^oo P™a = 
0 (lim^^oo Pf B = 0) where the probability of a decoding 
error at Alice (respectively Bob) is Pf A = P r [t?A(tts) 7 ^ s q B \ 
(respectively (Pf B = Pr[t? B (u^) 7 ^ s^]). 

C. Perfect Secrecy and an Upper Bound on the Achievable 
Secrecy Rates 

Perfect secrecy can be achieved with respect to Ray if the 
mutual information between Ray’s observation and the secret 
source symbols is zero, i.e., 

I(Y: Sa) = 0, perfect secrecy condition for Alice (7) 
I(Y;Sb) = 0 , perfect secrecy condition for Bob. ( 8 ) 

The input and output random variables in the PNC system 
model form respective Markov chains S q A -A U A -A X A —> 
-A Y n and S q B -A U% -A X% -a X% -a Y n . As a result, 
due to the data processing inequality, to satisfy conditions © 
and ® it suffices to show that 

I(Xr-,S a ) = 0 , sufficient condition for ©, (9) 

I(Xr]S b ) = 0 , sufficient condition for ®. ( 10 ) 

For fixed input distributions, encoders, and channels, we 
will study the perfect secrecy rate£] R S A and R S B provided 
© and ( I I Oi l are satisfied. To measure the optimality of our 
encoding schemes, we will compare them with the following 
upper bounds (UBs) on the achievable perfect secrecy rates: 

R s a<R s a = [I(Y b -,X a \X b ) - I(Y-,X a )} + , (11) 

R s b<R s b = [I(Y a -X b \Xa) - I(Y-X b )) + • (12) 

2 As the messages are delivered over two transmission cycles, one should 
potentially multiply all upper bounds and rates by however we omit this 
factor for clarity and as it does not affect the nature of our results. 






4 


In the following section we investigate R S A and R S B further 
for noiseless channels. In ifUfl it was only shown that (UTb 
and lfl2l > are achievable for weak secrecy as in (|T]). As we 
consider only perfect secrecy, the above serve only as upper 
bounds. However, their intuitive and easily-computable nature 
yields them useful nonetheless. 

III. Upper Bounds in the Noiseless Scenario 
Throughout this section and the next we assume that 

(i) the pmfs of X A and Xg are uniform, and 

(ii) all channels are fixed and invertible. 

When channel state information is globally available, we 
assume that Alice and Bob employ channel precoders, denoted 
respectively by gA and gg, such that 

hAgA—hggB (13) 

so that Ray observes 

y = h A gAXA+h B gBX B +w R = h A gA(.x A +xg)+w R . (14) 

Ray now attempts to recover the sum x a + x B ■ The secrecy 
of our proposed encoders depends only on the structure of the 
sum xa + x B , so we set w R = 0 in the next two sections. In 
this noiseless environment, Ray can post-multiply the received 
signal in by ( JiAgA ) 1 to recover xa + x B exactly. 
Similarly, the Ray-Alice and Ray-Bob channels are assumed 
noiseless. We summarize by adding a third assumption: 

(iii) All channel gains are equal to unity and all noise sources 
are zero, that is, h A = hg = h A = hg = 1 and wa = 
w B = w R = 0. 

While this may seem unrealistic, we are rather interested in the 
achievable perfect secrecy rates based solely on the structure 
of the sum xa + xg itself. Thus while the presence of noise 
and channel gains can have a deteriorating effect on Alice 
and Bob’s overall data rate, removing assumption (iii) will 
not affect perfect secrecy relative to Ray, nor will it affect the 
perfect secrecy rate relative to the overall data rate. 

We note that although channel inversion is impractical in 
Rayleigh environments, it can be employed whenever a line 
of sight (LOS) exists between either transmitter and Ray, 
i.e., whenever a Rician, a Nakagami-m or other large scale 
fading channel model f36l is applicable. We will return to 
the question of designing optimal precoders gA and gg in the 
presence of noise in Section [V] 

A. An Upper Bound on the Achievable Perfect Secrecy Rate 

In the noiseless setting with unit channel gains, the set of 
all possible observations at Ray is 

y = Xr = {xa + Xg | X A £ X A ,Xg £ Xg} (15) 

which comes with an addition function 

: X A x Xg -A y, l/j(x A ,Xg) = X A + Xg. (16) 

Crucial to our analysis are the sets 

^(y) = {(x A ,xg) \ y = x A +xg}. (17) 


The pmf of Y is given by the convolution of the pmfs of X A 
and Xg, which is clearly seen to be 

pr(y)= Px a (xa)px b (x b ) = (!8) 

XA,XB B 

X A +XB=V 


The following proposition gives a compact, intuitive upper 
bound on the achievable secrecy rates R S A and R S B . 

Proposition 1: In the noiseless scenario R A and R B are 
equal. Furthermore, denoting R s = R S A = R S B , we have 


R s 


^ lo g 2 |i/> \y)\ 
ycy 


M A Mg 


(19) 


Proof: See Appendix [A] ■ 

In the noiseless scenario we therefore simply define R s to 
be the perfect secrecy rate UB. Intuitively, for a given y £ y, 
log 2 | ip~ 1 {y) | measures equivocation at Ray in bits, and should 
therefore upper bound the total number of secret bits that Alice 
and Bob can transmit when Ray observes y while maintaining 
perfect secrecy. The quantity |V ,_1 ( 2 /)|/M j 4 .Mb = py(y) 
measures the frequency at which Ray observes y, properly 
weighting the sum as a rate calculation would. However, note 
that to fully exploit the value of |t/> -1 (y)|, Alice and Bob 
would need to know this number, and hence need non-trivial 
knowledge of each other’s symbols, in advance. 


B. Guaranteed Entropy 

In this subsection, we establish upper bounds on the achiev¬ 
able secrecy rates in the scenario in which Alice and Bob have 
no knowledge of the other’s symbols. For such a scenario, 
these upper bounds are necessarily tighter than the above R s . 
First, we define for any symbols x A and xg a useful notion 
of the amount of confusion Ray is guaranteed to experience 
when transmitting one of these points. 

Definition 1: For any x A £ X A we define the guaranteed 
entropy of xa to be 

s(x A ) = min log 2 \tp~^{x A + x B )\. (20) 

xb^Xb 

and similarly for any xg £ Xg we define 

s(x B ) = min log 2 \ip~ 1 (x A + x B )\. (21) 

xa&Xa 


The following proposition is more or less immediate. 

Proposition 2: In the noiseless scenario with unit channel 
gains where Alice has no knowledge of xg and Bob has 
no knowledge of x a, the achievable secrecy rates are upper 
bounded by R A < R A and R B < R B where 


ri= E 

Xa£^a 


s(x A ) 
M a ’ 


r s b= E 

xb GA’b 


Mg 


( 22 ) 


Proof: Suppose that a secret message sa of length 1(sa) 
is encoded in xa, so that log 2 1(sa) measures the amount of 
information in in bits. For any xg, Ray can determine 
rriA — log 2 \ip~ 1 (xA + Xg) | of the total number m A of 
bits transmitted by Alice. As Alice has no knowledge of 
Xg, the value of l(x A ) must be independent of Xg, and it 
follows that maintaining perfect secrecy requires log 2 1(sa) < 






5 



Fig. 3. The pmf of Ray’s observation y = -\~%b in the noiseless scenario 

with channel gains Ha = h>B = 1- Here Alice employs a 4-PAM modulator 
and Bob a 16-PAM modulator. 


l°g 2 \if> 1 (x A + Xb) | for all xb ■ Hence log 2 l(x A ) < s{xa), 

from which it follows that 

R s a< ! og 2 Ksa) ■ Px a {x A ) < (23) 

xaEXa xaGXa A 

as claimed. Identical reasoning applies to Bob. ■ 

Note that the above upper bounds R S A and R S B hold re¬ 
gardless of the nature of the input distributions Sa and S B \ 
that is, they apply to non-binary and non-uniform secret input 
distributions alike. Similarly, they hold regardless of whether 
one chooses to code over several time instances. 

C. Upper Bounds on the Achievable Perfect Secrecy Rates for 
PAM Modems 

Let us now study a familiar scenario in which Xa and Xb 
are, respectively, Ma- and Mb- PAM constellations, so that 
Xa is the uniform distribution on 


modulators with Mb > 2M A , we have 


R s 


M b 
= m A - 


-M a + 1 
Mb 


Ma- 1 

+ lo S2(a) 

a= 1 


2 a 

MaMb 


(25) 


In particular, for fixed Ma we have limM B ->oo R s = tu A - 
Proof: See Appendix iBl ■ 

The follow proposition explicitly computes s(xa) and 
s(xb), which immediately results in explicit expressions for 
R s a and I if of Section flll-BI which do not assume cooperation 
between Alice and Bob. 

Proposition 4: In the noiseless setting with unit channel 
gains when Alice and Bob employ M A - PAM and Mb -PAM 
modulators with Mb > 2Ma, the guaranteed entropies of x a 
and xb are given by 

s(x A ) = log 2 ^--- J (26) 

. f rn A \x B \ < M b -2M a + 1 

S (* B ) - | log 2 ( ^+1-1^1 ) otherwise. 

Proof: See Appendix [C] ■ 


D. Effect of Time Synchronization Errors on the Upper Bounds 

One of the main issues in PNC networks is that the assump¬ 
tion of perfect time synchronization is too optimistic. In this 
subsection we investigate the effect of time synchronization on 
R s when Alice and Bob employ M-PAM modulators. In this 
case the analog signals transmitted by Alice and Bob, denoted 
by t >4 (t), and t B (t) respectively, can be expressed as: 

OO 

t A (t) = ^2 x A (l) cos(2nft)g(t — IT — 5 Ta), (27) 

l= — OO 
OO 

t B {t) = ^2 x B (l)cos(2nft)g(t-IT - ST B ), (28) 

l= — OO 


X A = {—(M a — 1),—(Ma — 3), ..., M a -3 ,M A - 1} (24) 

and similarly for X n. Throughout this section we assume that 
Mb > 2Ma- The theorems of this subsection evaluate the 
upper bounds of the previous subsection for PAM modems. 

Proposition 3: In the noiseless setting with unit channel 
gains when Alice and Bob employ M A - PAM and M«-PAM 
modulators with Mb > 2 Ma, we have 

\^~\y)\ = 

0 y odd or \y\ > Mb + Ma, 

MB+ ^~ |y| M b — Ma + 2 < \y\ < M B + M A - 2, 
M a \y\ < M b - M A - 

Proof: This is a straightforward calculation and is there¬ 
fore omitted. ■ 

The above proposition in conjunction with (fl 8 l) allows us 
to explicitly describe the Ray’s pmf pyfy). In Fig. Q] we plot 
the values of \'f~ 1 {y)\ for Ma = 4 and M B = 16. In the 
following sections we will exploit the trapezoidal nature of 
Ray’s pmf when constructing explicit encoding functions. 

Theorem 1: In the noiseless setting with unit channel 
gains when Alice and Bob employ A/ 4 -PAM and Mg-PAM 


where T is the symbol period, ST a and 61)} denote the 
synchronization errors at Alice and Bob respectively and are 
assumed to be uniformly distributed in the range [0,T] and 
g{t) denotes the transmitter filter (commonly implemented 
as a raised cosine filter). Here for simplicity we assume 
that the transmitter filter is a simple rectangular window of 
length equal to the symbol period T. Neglecting all other 
noise sources and assuming that Ray employs a matched filter 
receiver implemented as a standard correlator receiver, Ray’s 
observation y(l) during the /-th symbol can be expressed as 

2 f 0 

y(l) = — / x A (l - 1) cos 2 (2 tt ft)dt 

1 1-STA 

2 pT-sta 

+ 2 x a( 1) cos 2 (2 tt ft)dt 

1 J 0 

2 

+ 7 T x B {l ~ 1) cos 2 (2n ft) dt 

1 J-STb 

2 pT—stb 

+ — / x B (l) cos 2 (27r/i)dt 

1 Jo 

= (1 — a)xA + (1 — (3)xb + ax A {l — 1) 

+ /3x b {1-1), (29) 
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Fig. 4. Numerical evaluation of the UB R s in the presence of time 
synchronization errors denoted by STa and STb■ The symbol period is 
normalized to unity T = 1. 


where 


sm 47r 


(4^) 


P = 


47r 

( 4 -m 


sm 


47T 


+ 


ST a 
T ’ 
ST b 
T 


(30) 


(31) 


As a result of time synchronization errors, Alice’s and Bob’s 
symbols are misaligned when reaching Ray. We investigate the 
effect of this misalignment on the UBs by numerically evaluat¬ 
ing (fTTl i and ( I I 2b . The results are depicted results in F-'ig. [4] for 
relatively small synchronization errors STa, STb < 0.25 T, the 
effect on R s is negligible. On the other hand, as the synchro¬ 
nization errors increase their impact on the UBs becomes 
increasingly important. Interestingly, due to the sinusoidal 
parts of a and /3, there are four regions of values of (STa, STb) 
- around the points (±, ±) , (±, §) , (§, ±) and (§, §) - in 
which the decrease in R s is more acute. 


IV. Explicit Encoder Construction with PAM 
Modems in the Noiseless Scenario 

Throughout this section we assume that Alice and Bob use 
PAM modems with sizes M,\ and Mb, respectively, satisfying 
Mb > 2 A / 4 . We retain the assumptions of the previous 
section, namely that all channels are noiseless and all channel 
gains are set to unity. 

The central idea behind the proposed approach in designing 
the secrecy encoders p a and p B stems from the following 
observation. The superposition of two PAM signals is equiv¬ 
alent to the convolution of two uniform pmfs; the resulting 
pmf contains a “flat” region in which Ray’s observations are 
equiprobable and two “linear” regions in which combinations 
of symbols occur with increasing/decreasing probabilities, as 
demonstrated in Fig. [3] for Ma = 4 and Mb = 16. 

In this section we construct explicit secret bit encoders 
at both Bob and Alice, compute the corresponding perfect 
secrecy rates, and compare the results to the relevant upper 
bounds of the previous section. The first subsection is devoted 


to the situation wherein neither Alice nor Bob has any infor¬ 
mation about the other’s transmitted signal; thus comparison 
of the obtained secrecy rates with the upper bounds R S A and 
R s b is appropriate. The scheme is shown to perform close to 
these upper bounds, but Alice’s rate is somewhat deficient in 
an absolute sense, in that as Ma oo, it leaves a constant 
gap to the optimal asymptotic behavior of rriA bits/sec/Hz. 

To increase Alice’s secrecy rate, in the second subsection 
we study her achievable secrecy rate when she has knowledge 
of Ls(^b)J (where [-J denotes the floor function) prior to the 
transmission of this symbol by Bob. We construct a simple 
scheme which rectifies the deficient asymptotic performance 
of the scheme of the previous subsections. 

A. Explicit Encoder Construction 

This subsection presents an encoding scheme for both Alice 
and Bob which does not depend on either user having any 
knowledge of the other’s symbols, i.e. no cooperation is 
necessary between Alice and Bob. For simplicity we only 
describe Bob’s encoding function; obvious remarks apply to 
Alice throughout. We construct our encoding function by 
first describing a bit labeling procedure on each of Bob’s 
constellation points. We then declare certain bits of x B to 
be secret and the rest to be public, depending essentially on 
the value of s(xb), which in turn effectively determines the 
encoding procedure. 

We begin by defining subsets X^ and X^' 1 of Alice 
and Bob’s constellations, respectively, for each index k = 
0, ..., rriA, whose usefulness is made clear by the subsequent 
proposition. Recall that Mb > 2 Ma- 
For Alice’s constellation, we set 

X { A ] = {x A | M a — 5 < \x A \ < Ma - 1} 

Xf = {x A | M a - 1 - 2 k + 2 < \x A \ <M a -1- 2 k+1 } 

for k = 1,..., wia — 2, and 
X^T = 0 for k = rriA — 1, triA 
For Bob’s constellation, we define 

Xf } = {x B | M b - 5 < |® B | < M b - 1} 

X {k) = {x B | M b - 1 - 2 k+2 < \x B \ <M b - 1- 2 k+1 } 

for k = 1,..., rriA — 1, and 
X { B mA) = {x B | M < M b - 2 M a - 1} 

Proposition 5: The subsets X^' 1 and xj k) satisfy 

s(xa) > k for all xa G x'T (32) 

s(xb) > k for all x B G X ( j k> (33) 

and their cardinalities are given by 

\X {k) | = 2 k+1 if 1 < jfc < m A - 2 (34) 

and 

\y(k)\ _{ 2 k+1 if 1 < fc < m A — 1 

1 B 1 l M n - 2M A if k = rn A K ' ’ 

Proof: This is a straightforward but lengthy application 
of the formulas for s(xa) and s(xb) given in Proposition [4] ■ 
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The set X B nA ^ is maximal in the sense that one can easily 
show s(xb) < rriA for all xb ^ Xb U {±(M b — 2Ma + 1)}. 
Thus Xg lA ^ is the largest subset of Xb on which Ray is 
guaranteed to experience the maximum number of bits of 
equivocation, namely tua, and whose cardinality is divisible 
by Ma- This latter condition is necessary to maintain the 
assumed uniformity of the random variables Sb and Xb- 
Similar remarks apply for the other X B . 

Our bit labeling procedure can be described pictorially by a 
perfect binary tree as in Fig. 0 Each point in Xb is assigned 
in increasing order to a leaf in the perfect binary tree with 
Mb leaves. The edges at each level of the tree are alternately 
labeled with a 0 or a 1. A point xb is then given a bit 
labeling by tracing the tree downwards from the root node 
to the corresponding leaf, so that the bit closest to the root 
node is the left-most bit in the string. For the example in Fig. 
[5] with Mb = 16, we have the bit labelings 0101 —t —5, 
1011 —> 7, etc. It is easy to prove by induction on ms that 
each point is assigned a unique bit string of length ms. 

We now declare the last k bits of all xb £ X B to be 
secret. To encode queues of public and secret bits. Bob begins 
at the root node of the tree and travels downwards, encoding 
public bits until he hits a node all of whose descending edges 
correspond to secret bits. He then switches to his queue of 
secret bits and begins encoding those, until the constellation 
point to be sent is completely determined. 

Example 1: Fet us set Ma = 4 and Mb = 16, and suppose 
that Bob wishes to transmit the public and secret (respectively) 
bit strings 

V B = 00110110, S B = 1001 (36) 



Fig. 6. The gap = | R A — Rf at Alice given the encoding scheme 
of Section m as a function of in a > 2 and evaluated using the explicit 
formulas from Proposition [4] and Theorem [2] 



He begins by encoding the left-most bits in Vb, namely 001, 
at which point the first bit in Sb (namely 1) determines the 
final decision in the tree. The first constellation point to be sent 
is therefore xb = —9, corresponding to the bit string 0011. 
He continues in this way, finally determining the symbols for 
transmission to be 


0011-»-9 =x B (l) 

1000 -A+1 =x b (2) (37) 

1101-M-ll = xg(3) 

where ;rg(i) is sent during the i th time instance. 

It is clear from the tree description that the secret bits 
encoded in X B ' represent all bit strings of length k uniformly. 
Thus the assumption of uniformity in the random variables Pg 
and Sb which model Bob’s public and secret input symbols 
guarantee that Xg is uniform as well. Moreover, it is clear 
from Proposition [5] that whenever Bob transmits k secret bits 
(that is, transmits a constellation point xb & X B ), Ray must 
guess uniformly at random from all possible bit strings of 
length k when attempting to decode the last k bits of the string 
corresponding to xb- Hence perfect secrecy is preserved, that 
is, I(Y;Sb) = 0. 

Theorem 2: The secrecy rates at Alice and Bob obtained 


Fig. 7. The gap A b — — R%\ at Bob given the encoding scheme of 

Section m as a function of tub for various values of Mb > 2Ma and 
evaluated using the explicit formulas from Proposition |4] and Theorem [2] 


using the present strategy are given by 


ir A - rn A - 3 + — 

R% = m A - -j^( M A - f) 


(38) 


In particular, for fixed Ma we have limM B ->oo R% = m A- 
Proof: This is a simple calculation given the sizes of the 

sets x[! : and T'!.!' 1 in Proposition^ In particular, since Alice 

(k) 

transmits k secret bits on X A , we have 


R 


S _ 

A ~ 


itia—2 

E k 


k= 1 


iE fc) i 

\Xa\ 


2 

Ma 


rriA —2 

E k2K 

k= 1 


We now make use of the formula 

n 

J2 k2 k = n2 n+2 - (n + 1)2" +1 + 2 

fc =i 


(39) 


(40) 


which can be easily proven by induction on n. Plugging into 
the above completes the proof for the calculation of Alice’s 
rate, and a similar computation is performed for Bob. ■ 
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X ( g ] = {-7,..., 7} and X™ = {-11, -9, 9,11}. 


As the present scheme does not rely on any cooperation 
between Alice and Bob, we compare the obtained secrecy rates 
to the corresponding upper bounds R S A and R S B . To measure 
the failure of our schemes to obtain the relevant upper bound, 
in Fig. [6] and Fig. [7] we plot the gaps 

A a = \R s a -R s a \, A b = \R% - R%\, (41) 

respectively, as functions of m,\ and tub (recall that neither 
R s a nor R a depends on run, and that both the rate and the 
upper bound were zero when m A = 1), 

The gaps A a and A b are seen to be less than 0.7 bits 
for all values of M A and Mb- Furthermore, the gap A/> 
at Bob shrinks to less than 0.35 bits for all Mb > 4M A . 
Note also that the gap Ab remains approximately constant 
for fixed Ma/Mb and increasing Mb, while the rate R S B and 
upper bound R S B increase without bound, thus showing that 
R S B /R s b —> 1 as the sizes of the constellations increase. These 
statements are in fact provable using the explicit expressions 
from Proposition |4] and Theorem [2] but as it involves a lengthy 
unintuitive calculation it will be omitted. 

B. Explicit Encoder Construction with Cooperation 

The scheme of the previous subsection left a large gap 
of approximately three bits between Alice’s secrecy rate and 
the upper bound R s , even asymptotically as the size of her 
constellation increases. In this subsection we show that Alice’s 
secrecy rate can greatly increase with knowledge of only 
[s(;eb)J prior to transmission, where |_-J is the floor function. 

Since we assume Alice has some knowledge of xb, we 
judge our scheme against the upper bound R s of Theorem 
0] We remark that R s implicitly assumes Alice has full 
knowledge of xb, while we assume much less and therefore 
this upper bound can be expected to be somewhat loose. 

The assumption that Alice knows some information about 
Bob’s signal is applicable if, for example. Bob transmits this 
information in a cryptographically secure manner to Alice 
before the current transmission cycle. Equivalently, one could 
assume that Alice and Bob both know the value of a given 
jamming signal, of which Ray has no knowledge. 

Knowing that = k prior to transmission, Alice 

can potentially transmit k secret bits in every a; A £ Xa ■ 
She exploits this knowledge by using the same tree-based bit 
labeling as in the previous section, but declares the last k bits 
of every a: A to be secret whenever [_s(£b)J = k. The nature 


of the bit labeling guarantees that for a given xb satisfying 
|_s(:tb)J = k, all bit strings of length k are represented 
uniformly among Alice’s symbols xa- Encoding public and 
secret bits proceeds as before. 

Example 2: Let us set M A = 8 and Mb = 32. For this 
example, we have 

|_s(:eb)J =3 oib = ±1) • • •, ±17 
Ls(zb)J =2 «i B = ±19, ±21, ±23, ±25 
Ls(x_b)J = 1 xb = ±27, ±29 
[s(xb)J = 0 <=> xb = ±31 

Suppose that Alice wishes to transmit the public and secret 
(respectively) bit strings 

V A = 01, Sa = 1111011 (43) 

and knows for the next three time instances that [xb(1)J = 3, 
[xb{ 2)J = 2, L^b( 3)J = 2. She thus transmits 3 secret bits 
in the first time instance, 2 in the second, and 2 in the third. 
The output of the tree encoder is therefore 

111 —t ±7 = ac A (l) 

010 — >■ —3 = ac A (2) (44) 

111 — »■ +7 = £ A (3) 

Notice that for these values of M A and Mb, Alice’s secrecy 
rate according to the scheme of the previous section was only 
0.5 bits/sec/Hz. 

Theorem 3: Suppose that Alice and Bob employ M A - and 
Mb -PAM modems with Mb > 2M A , and assume that Alice 
has prior knowledge of the value of Ls(:eb)J for all x «. Then 
Alice can obtain the secrecy rate 

RSA = mA ~^ MA ^ l) + l^- (45) 

using the above-outlined encoder. In particular, for fixed M A 
we have lim Ms _ >00 R S A = m A . 

Proof: Using the explicit formula for \4>~ 1 {y)\ given in 
Proposition [3] one can compute that 

I^IL»(-'>)j=‘}l = {« B -2M, + 2 HZ' 1 

Whenever Bob transmits Xb such that [_s(£b)J = Alice 
transmits k secret bits uniformly at random. Her secrecy rate 
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employ linear precoders Ga, Gb G C Nxd , so that Ray 
observes 

y = HaGaxa + H b Gbxb + wr (47) 

where wr is a length M vector of additive noise, with 
entries i.i.d. zero-mean real Gaussian and variance a\ per 
real dimension. To guarantee that Ray only observes sums 
of information symbols, Alice and Bob then must construct 
Ga and Gb to satisfy 

H a G a = H b G b (48) 

so that Ray observes 

y = H a G a (xa + x B ) + w R (49) 


Fig. 8. The gap = \R S — R S A \ between Alice’s secrecy rate given the 
encoding scheme of Section IIV-BI and the upper bound R s , as a function of 
Mb for various values of Ma < 4 Mb- 


is therefore given by 


R S A = 1X1A 


M b 


- 2 M a + 2 

~W B 


m A - 1 

+ E k 


fc =0 


2 k+1 

Mb 


(46) 


which straightforward simplification using ( l40t shows is equal 
to the quantity stated in the theorem. ■ 

In Fig. 0 we plot the gap = | R s — R A | where R S A is the 

secrecy rate at Alice obtained from Theorem 0 and R s is the 
upper bound on the secrecy rates from SectionQ] While the gap 
can be as much as 1.7 bits for Mb = 2Ma, we note that 
one can prove A^ < 0.9 bits when Mb = 4 Ma and A^ < 
0.5 bits for Mb = 8 Ma- Furthermore, while R s is a useful 
upper bound, it implicitly assumes Alice knows xb exactly 
rather than simply the value of [.‘>(a;«)j, hence some non¬ 
trivial gap should be expected. Lastly, we note that for a fixed 
ratio Ma/Mb , we see that A^ —> constant, demonstrating 
that R s a /R s —> 1 as the sizes of the constellations increase. 


V. Generalization to the MIMO Relay Channel 

The previous two sections have assumed that all noise 
sources are zero. This section removes that assumption and 
simultaneously generalizes to a MIMO channel in which Alice 
and Bob each have N antennas and Ray has M > N antennas. 
We assume that Alice and Bob employ one of the encoders 
discussed in Section [IV] Having fixed a secrecy encoder, it 
is crucial to the success of Alice and Bob’s transmission that 
Ray decode the sum x A + Xb of their symbols correctly, a 
point we now address by studying optimal precoding matrices 
at Alice and Bob. 

Let us denote the channel matrices Alice to Ray and Bob 
to Ray by Ha, Hb € C M x N , respectively, and the channel 
matrices from Ray to Alice and Ray to Bob, respectively, by 
Ha and H /> £ C v x M . We assume all matrices are selected 
from a continuous distribution and are therefore full-rank with 
probability 1. 

Let d < N and suppose Alice and Bob wish to transmit 
length d vectors x A and xr of information symbols. They 


from which he attempts to decode the sum x A + x «. Hence 
condition d48l > is crucial to employing the secrecy encoders of 
the previous section. 

We further impose power constraints on Alice and Bob by 
first defining their average per-symbol power by 

P A = Ela^l 2 , Pb = E|x Sii | 2 (50) 

where xa — ■ • ■, x A ,d) T and x A ,i is a PAM symbol, 

and similarly for Xs,i- To maintain this constraint after pre¬ 
coding we impose the conditions 

\\G a \\ 2 f <N, ||G b ||!<A. (51) 

Here we recall that ||A|||, denotes the Frobenius norm of a 
matrix A, defined by JT of, where a t are the singular values 
of A. Note that assuming (l48l > and (l50l >. and after appropriate 
scaling of the channel matrices Ha and H />, we have that the 
average power of the received signal at Ray is Pr = Pa + Pb- 

A. Degrees of Freedom 

It is well-known and not hard to show (see |32), J37), ED) 
that the degrees of freedom d of interference-free transmit 
dimensions available to both Alice and Bob is bounded by 
d < (2 N — M) + , and that every d satisfying this inequality 
admits an interference-free transmission scheme. Let us recall 
briefly how such schemes are constructed. Let Ha and Hb 
be the column spans of Ha and Hb, respectively, so that 
dim H a D H b = {IN - M)+. If d < (2 N - M)+ then 
Alice and Bob decide on a d-dimensional subspace S of 
this intersection, and then choose N x d precoding matrices 
Ga,Gb such that span H a Ga = span HrGb = S. In a 
similar manner, d < (2 N — M) + guarantees that Ray can 
transmit his PNC codewords back to Alice and Bob without 
the loss of any signal dimensions. 

To ensure successful encoding and decoding which maxi¬ 
mizes the degrees of freedom, we therefore restrict to d, M, 
and N satisfying 1 < d = 2 N — M from now on. 

B. The Dimension of the Space of Precoders 

In this subsection we compute the dimension of the space 
of all Ga and Gb satisfying the secrecy constraint < l48b and 
the power constraint (f5~il . The dimension of this space mea¬ 
sures the number of independent parameters when choosing 
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precoding matrices, and determines the difficulty of optimiz¬ 
ing the precoders numerically. To be mathematically precise, 
‘dimension’ here means ‘dimension as a real manifold’, but 
we omit the mathematical technicalities in favor of exposition. 

If Ga and Gb are any precoders such that | G A \ \ < N and 

\\G b \\ 2 f < TV, then we can always improve the performance 
of the system by multiplying both precoders by a constant so 
that either ||Ga|||’ = TV or ||G R || F = TV. So from now on 
we assume that one of the inequalities in (|5H is an equality. 
On the other hand, the probability that both inequalities are 
actually equalities, e.g. that both precoders can be chosen to 
maximize both Alice and Bob’s transmit power, is zero. 

Proposition 6: Fix TV < M and d = 2 TV — M > 1, and let 
Ha, Hb £ C MxN be generic full-rank matrices. Consider the 
matrix equation HaGa = HbGb for some variable matrices 
G a ,G b £ C Nxd such that ||G A |||- < N or \\G B \\ 2 F < N, 
and that exactly one of these inequalities is an equality. Then 

dim R T> = 2(d 2 - 1). (52) 

where dim R denotes dimension as a real manifold and V is 
the space of all such Ga, Gb satisfying the above conditions. 

Proof: As a real Euclidean space, the dimension of the 
space of all pairs Ga,Gb £ C Nxd is ANd. Accounting for 
both real and imaginary parts, the equation HaG a —HbGb = 
0 defines 2 Md linear equations in the entries of Ga, Gb, all 
of which are independent by the assumptions that Ha and 
Hb generic and full-rank. Furthermore, suppose without 
loss of generality that ||Ga||^ = TV. This single additional 
quadratic equation further reduces the dimension of the total 
space by two. Putting this all together gives us dimpiT’ = 
4 Nd — 2 Md — 2 = 2(d 2 — 1) as claimed. ■ 

Thus when the degrees of freedom of the system is 
maximized, we have dimP = 2 (d 2 — 1) dimensions to 
optimize over when constructing optimal precoders. When 
( M,N ) = (3,2) or (5,3), for example, the dimension of V 
is zero and thus V consists of only isolated points, meaning 
that additional steepest descent optimization cannot improve 
system performance. 


C. Optimizing Precoders at Alice and Bob 

While the previous section addressed the difficulty of opti¬ 
mizing precoders, in this subsection we address exactly what 
objective functions should be optimized. Successful transmis¬ 
sion between Alice and Bob requires Ray to accurately detect 
the sum x a + x B - That is, assuming the secrecy constraint 
HaGa = HbGb is satisfied, Ga and Gb should then be 
designed to maximize the mutual information at Ray. We see 
that the task at hand is the following optimization problem: 


maximize 

Ga,Gb 

subject to 


I(Y;X a + X b ) 

( max{||GA||!,||G B || 2 F }< N 
l HaGb = HbGb 


(53) 


where Y = H A C A X A + HbGbXb + Wr as before. No¬ 
tice that the constraints exactly describe the space V of all 
precoders studied in Proposition [ 6 ] 

It is important to note that the goal of the above optimization 
problem is not to increase the secrecy rate for either Alice 


or Bob, as the protocols of the previous section have already 
fixed this quantity. Rather, we seek to increase the overall data 
rate of the total received signal at Ray, subject to the secrecy 
constraints. 

1) Zero-forcing precoders: A straightforward zero-forcing 
scheme which satisfies the power and secrecy constraints of 

" E a ' 

V-e b \ 

columns form a basis of the right nullspace of the M x 2N 
block matrix [H a H b ]. Now set 

Ga = V~NE a /'), G b = VNEs/'y 
7 = max{||£U||F,||£B|k} 


is the following. Let 


be a 2 N x d matrix whose 


(54) 


and it follows immediately that H a G a = H B G B as desired. 
When N = M = d, we can take G A = \f~NHf 1 /'y and 
G b = \/NHf l 1 /'y, where 7 = max{||fT^ 1 ||F, H-H^Hf}. 

Every pair Ga,G b of precoding matrices satisfying the 
secrecy and power constraint can be constructed via the above 
process. However, for certain parameters of M and TV, one 
can further optimize some initial zero-forcing scheme. 

2) Relaxation using the gap approximation: As an attempt 
at an improvement on the above scheme, let us suppose that 
the power and secrecy constraints of (l53l > are satisfied and use 
the gap approximation to approximate I(Y ; X A + X B ) by the 
channel capacity: 


C {Ha ,h b) « I{Y; X A + X B ) + T (55) 

where T is a constant. By a well-known formula ||39l , the 
channel capacity (for fixed H A , H b ) is then 

G(h a ,h b ) = l°g2 det (iM H—■—2- H a G a G\h\\ 

v a R J 

(56) 

The relaxation of the optimization problem at hand is then 
to maximize C^h a .h b ) over P a i rs ( G A ,G B ) subject to the 
same constraints of (l53l l. At first glance ///> and G B are absent 
from this expression, but recall that we have already assumed 

that H a G a = H B G B - 

To optimize (l56t numerically, one performs steepest descent 

\G a 1 


as follows. Let G = „ , so that the task is to optimize over 

LG r J 

all possible G satisfying the power and secrecy constraints. 
The constraints of ( l53l ) restrict the set of all possible G to 
a bounded region of Af = null \H a ~H b \ ■ One performs 
steepest descent on the coordinates of G as normal, but after 
every iteration replaces G with the projection Proj^G and 
scales both blocks of G to satisfy the power constraint of 
( | 53 | ). We omit further details. 

In Fig. [9] we plot the channel capacity 1561 ). Here the “zero¬ 
forcing” precoders were found according to (l54l >. The “gap 
approximation” precoders were then numerically optimized 
according to (l56l >. and results were averaged over 10 3 pairs 
( H a ,H b ) of channel matrices. The entries of II A and H b 
were drawn from i.i.d. complex zero-mean circularly symmet¬ 
ric Gaussian distributions with variance 1/M. 

The most notable feature of Fig. [9] is that further optimiza¬ 
tion improves the precoding schemes for (M, TV) = (3,3) 
and (4,3) quite a bit, but offers no improvement for the 
other two cases. This is explained by Proposition [ 6 j since 
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Fig. 9. The expected ergodic capacity E gj A h d )C( h a P j as computed 
by (56j for randomly chosen zero-forcing precoders of 454b, an d those which 
have been further optimized using the gap approximation HD of the mutual 
information I(Y ; + Xb)- 


only for these parameters is diniR V = d 2 - 1 > 0 . 

Secondly, the performance of the gap approximation precoder 
for (M, N ) = (4, 3) is better than that of the zero-forcing 
precoder for (M, N ) = (3, 3), even though the second scheme 
offers an additional degree of freedom. Hence at the practical, 
finite SNR regimes of interest, specific precoding matrices may 
have more impact on capacity than the degrees of freedom. 

VI. Conclusions and Future Work 

We have studied the potential for perfect secrecy in a 
single-relay network with two users. Given finite, uniform 
input distributions, we have calculated upper bounds for the 
perfect secrecy rates under the assumptions that one user does 
or does not have information about the other user’s signal, 
made these upper bounds explicit for PAM modems, and 
discussed the impact of synchronization errors on secrecy. 
Two schemes that achieve perfect secrecy were presented 
using standard M-PAM modulators, one which assumes no 
cooperation between the users, and one which assumes the 
user with the smaller constellation knows some information 
about the other user’s signal. Gaps to the relevant upper 
bounds were shown to be small, especially asymptotically 
as the size of the larger constellation increases. The system 
was generalized to a MIMO setting, and precoding matrices 
maintaining the required secrecy constraints were studied. 
Finally, the potential for lattice encoders, alternative power 
allocation schemes, and applications to larger relay networks 
will be examined in the future. 

Appendix 

A. Proof of Proposition 1 

Proof: We first show that the UBs in the noiseless 
scenario are given by 

R s A =m A -I(Y-X A ), R s B =m B -I(Y;X B ). (57) 

where we recall that m A = log 2 M A and m B = log 2 M B . To 
see this note that in the noiseless scenario, the assumptions 


of Section HT1 guarantee that I(Y B ;X A \X B ) = m, A , as Alice’s 
symbol is perfectly recoverable given Bob’s observation. The 
above follows for Alice by substitution into dTTb . and the result 
for Bob follows by symmetry. 

By the above it suffices to compute the mutual information 
I(Y;X a ). We first fix a single x A £ X A and compute the 
marginal mutual information I(Y;x A ). An easy computation 
reveals that the joint distribution (Y,X A ) has pmf 


PY,x A (y,x A ) 


|i/> 1 (y) n ({am} x X B ) | 

m a m b 

I o, n ({cca} x Xb) = 0 

l MjMi"’ otherwise 


Computing the mutual information I{Y\x A ) now gives 


I(Y ; x A ) = Y PY,x A (y , x A ) log 2 
vey 


( PY,x A (y,x A ) \ 
\PY{y)px A (x A )J 


y- 1 , M a 

x M^ og2 2F^y)\ 

y&x A +X B 


(58) 


Summing up over all x A , we arrive at 


I(Y-X a )= Y, I(X\xa) 

= m A- y 

x a gx a yey 

y£x A +X B 


log 2 |V’ 1 {y) | 
M a M b 


= m A -^log 2 |^- 1 ( 2 /)|^-^ (59) 


y&y 


where the last equality follows by grouping like summands 
together. An analogous calculation holds for Bob, and the 
proposition follows. ■ 


B. Proof of Theorem 1 

Proof: Define S = J^yey lo §2 l'0 _1 (2/)l ■ IV'~ 1 (?/)I- We 
can use the explicit formula for \i/r~ 1 (y)\ from Proposition [3] 
to write 5 as S = F + L where 


Mb —Ma 

F = Y, m A M A 

y=—(M b— Ma) 
y even 

Mb~\~Ma —2 

L = 2 Y lo & 

y=Ms— Ma+2 
y even 


^ m b + m a 


y^ M b + M A - y 


The number of even integers in the interval [ -{XI B — 
M A ). M B — M a ] is exactly M B — M A + 1, and hence 
F = rri aAI A (AT B — M A -(- 1). Making the change of 
variables a = transforms the sum L into L = 

^Yl!a='- l _1 l°g 2 ( a ) a - We can conclude the proof by recalling 
that R s = S/M a A4 b = (F + L)/M A M B , which is easily 
shown to be equal to the quantity in the theorem given the 
above calculations. ■ 
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C. Proof of Proposition 4 

Proof: By the symmetry of Xa we have s(— xa) = 
s(xa)- When xa is positive it is clear that \i/j~ 1 (xa + xb)\ 
is minimized when xb = Mb — 1 and thus 

s(x A ) = s(|xa|) = log 2 hA -1 (Ms - 1 + |xa|)| (60) 

Using the formula ([3]) for |t/i _1 (t/)| in the proof of Theorem 
U] and performing simple algebraic manipulations yields the 
following formula: 

( \ i (Ma + 1 — \xa\\ 

s(x A ) = log 2 (--- J (61) 

The first part of the proposition now follows easily from 

simple algebraic manipulations. A similar calculation holds 

(k) 

when computing s(xb)- Computing the sizes of the sets X A ' 

(k) 

and X B follows straightforwardly from the definitions. ■ 
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